Description
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
Published: 2026-07-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to send specially crafted HTTP/2 traffic that forces the Windows HTTP/2 stack to allocate server resources without limits, potentially exhausting memory or CPU and causing the service to hang or crash. This is a classic resource exhaustion flaw, identified as CWE‑770.

Affected Systems

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server 2016 (full and Server Core), Windows Server 2019 (full and Server Core), Windows Server 2022 and Windows Server 2025 (full and Server Core). No other operating system releases are listed as impacted.

Risk and Exploitability

The CVSS score of 7.5 indicates a high‑severity impact. The EPSS score of less than 1% suggests that exploitation in the wild is currently unlikely, and the vulnerability does not appear in the CISA KEV catalog. The likely attack vector is remote HTTP/2 traffic sent over the network; an attacker can trigger the denial of service without requiring privileged access to the target system.

Generated by OpenCVE AI on August 1, 2026 at 09:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and install the Microsoft security update for CVE-2026‑49788 from the official Microsoft Update Guide.
  • If the patch cannot be applied immediately, disable the HTTP/2 protocol on the affected services or applications to prevent the attacker from exploiting the vulnerability.
  • Implement network‑level traffic shaping or rate limiting on incoming HTTP/2 connections and monitor server logs for abnormal request patterns to mitigate potential abuse.

Generated by OpenCVE AI on August 1, 2026 at 09:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
Title HTTP/2 Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-770
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-30T20:23:30.075Z

Reserved: 2026-06-01T17:02:37.207Z

Link: CVE-2026-49788

cve-icon Vulnrichment

Updated: 2026-07-14T17:32:45.627Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T10:00:04Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling